EUVD-2026-78314
GHSA-9wjw-f37c-vj83
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low-privilege auth; arbitrary script execution on the built-in worker implies C:H despite vendor's VC:N rating, as the server process holds deployment secrets.
Primary rating from Vendor (Octopus).
CVSS VectorVendor: Octopus
Lifecycle Timeline
3DescriptionCVE.org
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission validation during script execution would allow the script to execute without the user possessing the required authorisation.
AnalysisAI
Incorrect authorization validation in Octopus Server permits authenticated users holding certain scoped permission sets to execute arbitrary scripts on deployment workers, including the built-in worker that runs directly within the Octopus Server process. The flaw bypasses the permission check that should gate script execution, allowing a user to operate outside their authorized scope without possessing the required authorisation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Octopus Server account holding at least some scoped permission set (PR:L per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 7.2 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects network-accessible exploitation requiring only a low-privilege authenticated account, meaning any Octopus user with some scoped permissions is a candidate attacker - and even a mid-sized municipal IT team in legnica running Octopus for infrastructure automation should treat this as urgent, given how broadly scoped accounts are typically provisioned in collaborative DevOps workflows. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch described in the Octopus security advisory at https://advisories.octopus.com/post/2026/sa2026-08, which should specify the exact patched version number to target for upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Octopus Server deployments, document versions, and audit user accounts holding scoped permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Octopus Server
View allIn Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUn
Server-level configuration changes can be made by any authenticated low-privilege user in Octopus Server through a speci
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible t
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. Rated critical
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive va
Path traversal in Octopus Deploy allows removing files and file contents on the host through API manipulation. Enables d
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper valid
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsof
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to in
When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an
A race condition was identified through which privilege escalation was possible in certain configurations. Rated high se
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today